Requests for Records under the HITECH Act / Individuals’ Right under HIPAA to Access their Health Information 45 CFR § 164.524, also referred to as “The Privacy Rule”.

The HITECH Act was passed as part of the American Recovery and Reinvestment Act of 2009, to promote the adoption and meaningful use of health information technology.  The Act provides incentives to health care providers to transition to electronic health records. Additionally, there are also provisions concerning a patient’s right to their personal health information. The HITECH Act provisions were implemented via a Megarule in 2013, and effective that same year.

Under the HITECH Act, health care providers are required to provide every patient a copy of their electronic health records, in a format of their choice, at a reasonable cost. Additionally, the law allows patients to direct their health care provider to send a copy of their electronic health record to any party they designate, including their attorney.

What is important to keep in mind: Providers can only charge the labor for copying (not locating records), supplies (such as portable media), and postage. Providers may also charge a flat fee of $6.50. Requests under the HITECH Act supersede state law, and are not subject to the $1 per page set out in the Florida Administrative Code.

I have sent out many of these requests. Hospitals and large practices generally have no issue complying with HITECH requests. If I have encountered a billing error, i.e. invoices for the standard $1 per page, the invoice has been amended to $6.50 with a phone call. I have encountered issues with small practices, and I think how hard the provider is pushed depends on the circumstances. There are teeth for noncompliance with the Privacy Rule. There will be certain small providers who do not fall within the act–if they use paper files and do not have scanning equipment. However, that group will become smaller as time passes and technology advances.

I propose you include these elements of a Request on plain paper addressed to the provider from the claimant:

  • Full name and address of the claimant.
  • Full name and address of the provider.
  • Form and format requested. Electronic PDF and email/CD, etc.
  • Full name and date of birth in letter.
  • Send records to : Attorney [make sure choice is clear, conspicuous, and specific.”  42 U.S.C. § 17935(e)]
  • I would recommend you reject the summary or explanation of records.
  • Waiver of security in providing records in non encrypted file format.

A sample of the request I use is included here.

You can find an extremely comprehensive FAQ on the HHS website here.

If you have questions or comments about HITECH medical requests, please email me at

Mark Lee, Esq.